How to protect a small business from common website attacks

The attacks that actually happen

Small business websites are not usually targeted by masterminds. They are hit by automated bots scanning the internet for easy openings. Knowing the attacks makes them much less scary:

• Brute force — bots guessing your password, thousands of times an hour
• Outdated software — old plugins and themes with known holes
• Phishing — fake emails tricking you into revealing logins
• Malware injection — bad code hidden in your site, often to attack visitors
• DDoS — flooding your site with traffic to knock it offline

Seven defenses that stop most attacks

You do not need enterprise security. You need these seven habits:

• Keep your core files, themes and plugins updated
• Use strong, unique passwords plus two-factor authentication
• Take automatic daily backups and store them off your server
• Use HTTPS everywhere — an SSL certificate on every page
• Run a security plugin or monitoring that scans for malware
• Limit user accounts and permissions to what each person needs
• Choose a host with a firewall and brute-force protection

If you do get hacked

Act fast, in this order: change every password starting with your email and admin accounts. Contact your host — they have seen this before. Restore a clean backup rather than trusting a partially cleaned site. Then find how they got in, usually an outdated plugin, or it happens again.

Google will flag infected sites, which scares customers away. Once clean, request a review through Google Search Console.

Make security someone else's job

Most attacks exploit outdated software. A care plan handles updates safely, scans daily and watches uptime — from $49/mo. For a deeper look at where you are exposed, a security audit reviews your passwords, 2FA, backups and phishing risk for a fixed $349.

Ongoing security monitoring runs $199–$399/mo. It costs less than one hacked weekend.